feat(portal): M10.1 — fill the 10 customer-area shells

Four real surfaces wired to tenant-registry (settings, settings/api-keys CRUD, audit pagination, products live entitlements), five forward-looking empty states with CTAs. 56 vitest tests + 10 Playwright canaries. lib/format.ts consolidates date helpers.

Refs: M10.1

src/app/[slug]/settings/users/page.tsx

@@ -9,8 +9,9 @@ export default async function Page() {
   return (
     <ShellEmpty
       title="Users"
-      description="Invite IT_ADMIN, CXO, FINANCE, LEGAL, USER. Role assignment."
-      milestone="M10.1"
+      description="Invite teammates as IT_ADMIN, CXO, FINANCE, LEGAL, or USER."
+      milestone="M10.1 follow-up"
+      details="User management calls Keycloak's Organizations Admin API. The adapter exists (internal/keycloak in tenant-registry); this UI just needs the list + invite handlers wired."
     />
   );
 }